The Bolt-On Defenses

Part 4 of 6. In part three we walked the life of a seed and found the same property at every stage: the secret is exposed whole, and one read means total loss. The natural reaction is "fine, so I'll harden it," and the industry agrees: there's a whole aftermarket of hardening. Today we go through it honestly, piece by piece. What each defense actually fixes, what it quietly can't, and the pattern that appears when you line them all up. No strawmen: several of these would have saved people in the Coldcard sweep, and we'll say so.

---

The passphrase

Add a passphrase (often called the 25th word, though it can be any text) and your wallet derives from your 12 words plus your phrase. Different phrase, entirely different wallet, from the same words. A thief who finds your paper backup alone lands in an empty decoy or nothing at all, and has no way to even confirm a passphrase exists. That's real protection with genuine elegance, and it's notable that Coinkite recommended exactly this as a stopgap: an attacker enumerating a trillion weak seeds still has to guess your phrase on top of each one.

Now the fine print, because it's load-bearing. The protection equals the phrase's strength, and human-chosen phrases fail in depressingly predictable ways: names, birthdays, song lyrics, the motto on your gym wall, all of it sitting in the first hour of any serious attacker's wordlist. A phrase strong enough to genuinely matter is long and random, which means you can't remember it, which means you now maintain two secrets, stored separately, both required for recovery, both needing to survive decades and be findable by your heirs but nobody else.

And the failure mode inverts. Forget the phrase, or let its backup fade while the "main" backup survives, and you've achieved perfect security against everyone including yourself. There is no reset. Coins sitting in plain view on-chain, cryptographically yours, permanently unreachable. Real people do this every year, no attacker required. The passphrase is a good tool that converts external risk into self-inflicted risk, and you should know that's the trade before you make it.

---

Shamir backups

Shamir's Secret Sharing splits a secret into, say, 5 shares of which any 3 reconstruct it. The math is genuinely beautiful: hold 2 shares of a 3-of-5 scheme and you know literally nothing, not a partial hint, nothing. A burglar finding one share in your desk gets a worthless string. A flood eating another loses you nothing. There's even a standard for doing this with seed words, so the shares themselves look like familiar word lists.

What it fixes is exactly one stage of the map in part three: backup storage. The single piece of paper whose single read was total loss becomes several pieces whose partial discovery is harmless. Genuine progress.

What it doesn't touch: everything else. The seed still exists. It was born whole on one device in one moment (Shamir splits happen after birth, so a Coldcard-style flaw passes straight through). It lives whole on your signing device every day. And on recovery day it assembles whole again, on whatever machine you feed the shares into, which had better be honest. Meanwhile you've traded a storage problem for a decades-long coordination problem: three or five hiding spots to maintain, document for heirs, and remember yourself, with the quiet failure mode that shares drift, get moved "temporarily," and quietly drop you below threshold without any alarm going off.

---

Multisig

Multisig is the serious one, so let's be properly fair to it. A 2-of-3 multisig wallet requires signatures from two of three independent keys before coins move. Done right, that's three different devices, ideally from different vendors, stored in different places. Now a single stolen key moves nothing, a single lost key loses nothing, and a burglar needs to win in two locations before you notice either. This is real, structural security, not a patch. It's telling that in the Coldcard sweep, every single drained wallet was single-signature. A good multisig would have blunted this attack, and the people who run one deserve their sleep.

Two honest caveats, and they're the ones that matter for this series.

First, the birth problem doesn't go away. It multiplies. Each of those three keys is a normal key from a normal seed, born in its own one-moment-of-randomness on its own device. Multisig distributes signing. It does not distribute any individual key's birth. Build your 2-of-3 from three devices of the same model sharing the same broken generator, and you've built a fortress from three of the same cracked brick: an attacker who can enumerate one weak keyspace can enumerate all three. Device diversity isn't a nice-to-have in multisig. It's the whole load-bearing assumption, and almost nobody tells you that when you buy three of the bestseller.

Second, the human cost is the real gate. Run multisig properly and you're operating: multiple hardware devices across multiple locations, coordinator software, backups for every seed plus the wallet configuration itself (lose that descriptor file and recovery becomes an ugly puzzle even with enough seeds in hand), periodic health checks of keys you deliberately made hard to reach, and a written recovery procedure your family could execute without you, under grief, without getting phished. Bitcoin veterans genuinely do all this and love it. But a security model that asks a normal person to administer three devices and a config file, or to roll physical dice fifty times to be sure their own wallet isn't lying to them, is not a security model for the 99%. It's a hobby for the 1% who enjoy the operations. The gap between those two groups is where the next hundred million users live, unprotected.

---

The air gap

Keep the signing device off every network forever, ferry transactions across the gap by QR code or SD card, and the entire category of remote attack, malware, remote exploits, network snooping, dies at your desk. This works. It's why air-gapped signers exist as a category and why serious holders pay for them.

But Coldcard is the permanent counterexample, so say it plainly: Coldcard was the poster child of air-gapped security, and the attack never needed the network. The flaw shipped inside the device, from the factory, in the firmware. The gap did its job perfectly for five years, faithfully guarding keys that were born guessable. An air gap defends the castle walls. It cannot inspect what happened in the room where the key was forged, because that room is on the wrong side of the gap by definition, and so is every audit you can't personally perform on silicon and build systems.

---

Steel

Stamp the words into metal and they survive fire, flood, and thirty years in a wall. Durability: genuinely solved, and if your backup is currently paper, fixing that this weekend is the cheapest upgrade in this whole article. Secrecy: untouched, as part three covered. Steel answers exactly one failure mode, completely, and nothing else.

---

Line them up and look

• Passphrase: protects a found backup. Adds a second secret with its own life to manage.
• Shamir: protects backup storage. The secret still assembles, and was still born whole.
• Multisig: distributes signing, genuinely. Not each key's birth, and not the ops burden.
• Air gap: blocks the network completely. The factory was already inside.
• Steel: defeats fire. Full stop.

Every one of these is real, and stacked together they're formidable. We're not here to mock any of them; used well, they saved people in this incident and they'll save people next year. But step back and look at the shape of the list. Each defense manages a different consequence of one root fact: somewhere, a complete secret exists, and whoever reads it owns everything. So we armor the paper, split the paper, gap the network, multiply the devices, and the patching never ends, because the thing being patched never changes.

When a design needs this many aftermarket parts to be survivable by a careful expert, and still fails a normal human at the first forgotten passphrase, the interesting question stops being "which parts should I buy?" It becomes: why does the complete secret exist at all?

That question isn't rhetorical, and it isn't new. It has a concrete answer that's been running in production for years, securing sums that make the incident's $116 million look like a rounding error, and most retail users have never once been shown how it works. Next: the wallet where the complete key never exists. Not hidden well. Not split cleverly. Never exists, anywhere, from the first moment of its life.

Until then, we're reading everything: which of these defenses do you actually run today, and which have you been putting off, honestly? No judgment either way. The honest picture helps everyone reading this decide what to fix first.